The FTC Ramps Up Privacy Enforcement

Following increased congressional scrutiny over its data privacy enforcement practices in 2018, the FTC has ramped up its enforcement actions in recent months, giving some real bite to current federal privacy laws:

  • On February 27, 2019 the FTC filed a complaint against the operators of lip-syncing app Musical.ly—now known as TikTok – for failing to seek parental consent before collecting the personal information of users under the age of 13. In response to the FTC’s complaint, TikTok agreed to pay a $5.7 million settlement to the agency, marking the largest-ever COPPA fine in US history.
  • Throughout March, the FTC obtained settlements against 4 separate robocall operations: NetDotSolutions, Higher Goals Marketing, Veterans of America, and Pointbreak Media. These cases charged these separate entities for violations of the FTC Act (unfair and deceptive trade practices) and the agency’s Telemarketing Sales Rule (TSR) – including its Do Not Call (DNC) provisions.
  • On March 26, 2019 the FTC announced a broad inquiry into the data collection practices of broadband companies under Section (b) of the FTC Act. The agency issued orders to AT&T Inc., AT&T Mobility LLC, Comcast Cable Communications doing business as Xfinity, Google Fiber Inc., T-Mobile US Inc., Verizon Communications Inc., and Cellco Partnership doing business as Verizon Wireless, seeking information about the collection, retention, and sharing of personal information. The FTC investigation highlights recent consumer concerns about data privacy and tracking by ISPs, following high-level acquisitions of content providers like AOL, Yahoo, and DirectTV. We are watching closely, as this may be the start of one of the first joint privacy-antitrust enforcement actions by the FTC.

These enforcement actions highlight the FTC’s role as the de facto data protection authority for the United States. Yet, the FTC’s mandate extends far beyond data privacy, and includes regulatory authority over false advertising claims, anticompetitive behavior, and merger review. While Congress continues to debate the passage of a federal bipartisan privacy bill, it behooves them to keep in mind the current staff and funding limitations of the FTC in any proposed drafts.

Lily Li - Metaverse Law - Data Privacy - Critical Mass

Metaverse Law on Critical Mass Radio Show

On February 13, 2019, Lily Li of Metaverse Law appeared on Critical Mass Radio Show to discuss trends in privacy law and general pointers for businesses. Three takeaways from the show include:

  1. Regardless of the size of your company, consider data privacy. The size of your company itself is not as relevant as is the customer data you process. Even if you are a small company, but have a large customer base, chances are you should be looking at the data privacy regulation in your state. If you have customers overseas, such as in Europe, it is important to realize that you will then fall under European privacy laws. Privacy laws have to do with where your customers are, rather than simply where your company is based. Be aware and do your research to ensure that you are complying to the regulation that impacts your firm.
  2. Data belongs to the individual. While in the past, customer data was thought of as the company’s intellectual property, this is no longer the case. Customer data belongs to the individual, so treat it like it is their property ­ not just yours. Your clients have the right to tell your company what they want (and don’t want) done with their data, so it is crucial to ensure that you have a process in place to comply and verify with your customer.
  3. Put your data house in order. Data security affects many departments in your company, from the front end to the back end. As such, it is important to find a workflow so customer data is protected throughout its entire life cycle. Start by gathering all of your company’s department heads together in a room and ask them this key question: “Where do you store data?” From there, it will be clear what needs to be addressed when it comes to your data.

Listen to the full interview here:

Privacy Law Forecast for 2019

Image Credit: ID 23689850 © Steve Ball | Dreamstime.com

This past year was quite a whirlwind for privacy and cybersecurity watchers. Just to sum up a few of the top events of last year:

  • Facebook’s Cambridge Analytica scandal rocked political headlines
  • Europe introduced the GDPR, the most comprehensive data protection legislation to date in the world
  • California enacted the California Consumer Privacy Act, becoming the first US state to create GDPR-style rules
  • Google came under fire for allowing app developers to read your email, and track your location (even with location tracking off!)
  • Marriott’s guest reservation system was hacked, exposing the personal information of up to 500 million guests, including passport numbers and payment numbers for some of those hacked

What will happen in 2019? Here are our top 5 predictions:

Read More
California Consumer Privacy Act vs GDPR

California Consumer Privacy Act vs GDPR – How to Maximize Your Privacy Compliance Program

California’s recent passage of the Consumer Privacy Act of 2018 now places the world’s fifth-largest economy under European style data protection rules. Given the new law, US businesses that were previously hesitant to implement GDPR are now reconsidering their position.

Luckily, the GDPR and the California Consumer Privacy Act (CCPA or CaCPA) share some similarities. Both provide for consumer-facing privacy notices, data access rights, and data portability. As businesses automate their GDPR compliance processes, they should also leverage those same processes under the CaCPA to save significant time and expense.

Below, we have listed five common operational steps that all businesses should take in their GDPR and CaCPA privacy compliance programs:

Read More
Drones and Privacy Regulation

Regulating the Skies – FAA Drone Rules for Hobbyists

In 2012, Congress placed the Federal Aviation Administration (“FAA”) in charge of regulating small unmanned aircraft systems, also known as drones. In response, the FAA promulgated regulations in 2015 and 2016 targeting the drone industry. These regulations required operators to register their systems and meet minimum safety and certification requirements, but excluded operators of preexisting model aircraft.

So far, hobbyist drone operators have used the model aircraft exclusion to temporarily block drone registrations, relying on a D.C. Circuit court opinion by Judge Brett Kavanaugh in May of 2017. Trump signed a bill reinstating the registration requirement in December 2017, however. In addition, a recent court ruling out of the D.C. Circuit Court of Appeals, Taylor v. Federal Aviation Administration (Case No. 16-302), upheld the FAA’s ability to regulate hobby drone operators.

Read More
1 2 3